Detecting on IP taps

[gloworange]IP TAP[/gloworange] There is an private IP (wire tap) that appeared recently in the connection BETWEEN my computer/hub and my ISP's DNS servers. The IP is 10.zzz.zzz.zzz. It had never been there and I know it does not belong there. This is called an IP TAP.

Normally my trace from home goes...
xxx.xxx.xxx.xxx Hosting Service Name
yyy.yyy.yyy.yyy Hosting Service Name

Now it goes....
xxx.xxx.xxx.xxx Hosting Service Name
10.zzz.zzz.zzz (private use)
yyy.yyy.yyy.yyy Hosting Service Name

That PRIVATE USE label IP does not belong there; it is a PASS THROUGH SERVER also called a "Black Box" by most. My firewall is quite secure, and I sweep daily for any form of "spyware" or virus that may be on my computer; this IP TAP is a threat to our First & Fourth Amendment Rights.

The Internet Assigned Numbers Authority (IANA) has reserved the following three blocks of the IP address space for private internets:

10.0.0.0 - 10.255.255.255 (10/8 prefix)
172.16.0.0 - 172.31.255.255 (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

We will refer to the first block as "24-bit block", the second as "20-bit block", and to the third as "16-bit" block. Note that (in pre-CIDR notation) the first block is nothing but a single class A network number, while the second block is a set of 16 contiguous class B network numbers, and third block is a set of 256 contiguous class C network numbers.

Anyone that decides to use any IP addresses out of the address space defined above "can do
so without any coordination with IANA or an Internet registry". The address space can thus
be used by many enterprises and law enforcement agencies. Addresses within this private
address space will only be unique within the enterprise, or the set of enterprises which
choose to cooperate over this space so they may communicate with each other in their own
private internet. This allows the law enforcement agency that created the IP TAP to scan the
data stream for keywords or IP addresses and access that data from remote or centralized
locations.

ANY IP NUMBER FROM THE SEGMENTS LISTED ABOVE IS TO BE CONSIDERED COMPLETELY SUSPECT unless you actually know what the numeric IP address you are accessing or originating from/thru is a private one and should be listed that way.

HOW DO YOU DETECT SUCH TAPS?
What you do is simply get a program like the VisualRoute Trace program from visualware (at
http://www.visualware.com/visualroute/index.html) then you learn what is normal between you and your DNS servers. If one of the groupings above shows, then you have been tapped whether legally or illegally. Once it appears whatever you have been sending and receiving has already been recorded from the instant it became active.

=====
If this is in the wrong forum, please move it to where it needs to be in order to be seen; this is my first post on this site as I normally prefer to remain silent. AW

Interesting post; however, something bothers me about this. It is NOT necessary to place a box that routes between two segments in order to tap the segment and it strikes me as kind of odd that something that is meant to observe and trace would be so blantantly placed in the open. The easiest thing to do would be to have a machine with two NIC's, one with a private address (or no address if the OS lets you), one with a real address. You set the switch between the two segments to mirror all ports to the one that the NIC with address is assigned and you in effect have a passive tap that is, unless you have access to some device doing the routing on either sie (to detect the MAC of the passive device), undetectable.

I would think that the FBI would at least be savy enough to do this...

What are the chances that instead your ISP added another internal router ? It is perfectly legal to have things inside your AS with reserved IP addresses and perfectly legal to have your entire network routed with reserved addresses. What is illegal is to advertise those networks out to the rest of the world. So long as you have a device capable of NAT at your internet connection, you can do whatever you want inside your network....even illegal NAT (where you take a reserved IP range, say microsoft's, and use it on the inside but NAT it on the outside to a legitamate one...

Dunno, seems to me like there are other possibilities...

Neb

Perhaps this is the first implementation of project echelon. Perhaps now the internet as we know it is coming to an end, I doubt, but who knows? :) And I heard that the privately reserved IP addresses wouldn't work if they were connected to the internet, or that they wouldn't work correctly, because of their IP addresses. Cool post though, thanks for the info.

oops, serious typo: mirror all ports to the one that the NIC with address -->
mirror all ports to the one NIC that has NO address

Normally wouldn't post about a typo, but that was a pretty critical point...

And also, I prefer neotrace. It is nice, gets the job done and works in conjunction with the other programs like the neo-somethng firewall to offer more complete protection and detection. It does cost money though, so there is a downside.

Ummm, where did you get this information from? You can PM me if you want, I am just trying to figure this out. A 10.# is non-routable, so it shouldn't work, unless you dial into that box. It may also be a box inside your isp that is used as a router for firewall purposes. You will get a "private use" message every time you hit a reserved ip addy (10.x, etc.) When I do a traceroute from this machine, I get a private address before I even get to my router because of some goofy crap the last guy here was testing.

A pass through server is just a machine that sends on information. Much like a proxy server.

A "black box" is normally set up in promiscus (spelling) mode, so you will not see it on a traceroute. It works like a keystroke logger pulling anything from your connection, but you can't see it. If you are on a modem, then to find a "black box" you look for something installed in your dmark, or you hack the phone company and see what they have set up. On a broadband connection, you can only tell if you can detect a box in promiscus mode, and see what it is grabbing.

I am not saying you are wrong, I am just trying to figure this out....

I should have pointed out that I had done a fair bit of homework on this before I posted; I just narrowed down what I had learned so far to the basis - my error, I should have given you everything.

This "unit" is placed on the IN side of the broadband server not on the OUT (post-server) side; this allows access to the exact IP Address everything originates from without having to strip away any additional server generated addresses. It is quite an idea; but it had to be assigned some IP address so it could be accessed and to allow data to pass through oblivious to its interception, like if it was just another server on the route. I'll even give you the IP address of the thing... 10.228.200.1 I have it well memorized. So far I have not been able to get it to respond to id requests or anything, so let me know if you do. AW

I am having a hard time following what you are saying. I know for a fact that, so long as it is in your ISP's internal network, that they can use any IP addresses they want, including the private ones, and any combination thereof (however, using addresses assigned to someone else will give you major headaches if you ever need to connect to them...).

I do remember that way back when, windows 95 in combo with certain drivers would freak out over private addresses, but I haven't seen anything like that in years and can say that routers (for example cisco) do not care if the address is private or not, if they have a route for it, they route it (unless an access-list instructs them not to), ditto with firewalls, ditto with normal machines. It is very very common nowadays for a company to have their entire network devoted to private network address space that is not translated until it leaves the company network (or ISP).

For all I know you could be 100% correct in that it is a TAP; however, the only thing I was trying to say is that there are other possibilities. I know when we have tested equipment (or programs, etc, and we needed a quicky test LAN/segment) on our WAN/LAN we have inserted devices in the middle of two routable IP addresses that had private addresses on either side and suffered 0 side effects...had nothing to do with snooping on anyone...

Have you tried to telnet/http/ftp to the device, it might at least tell you nicely what it is (of course, then again it might not ;) )

Neb

If the setup that I previously mentioned was used, with a box that has two NICs, it would be possible to monitor anything that goes across the wire by attaching to the segment before any proxy servers/firewalls. By have the traffic passively mirrored traffic to the addressless interface of the NIC that is in promiscous mode, it is not necessary to sit in the middle of segment and pass traffic (try it and you will see). It would then be possible to monitor the traffic going by from the other IP address, unbeknownst to everyone else...


With a setup like this, I can take a binary dump of all traffic that passed by in a given time frame and entirely reconstruct every session that went by (assuming it was unencrypted), including files, usernames, passwords, emails, etc.

neb

It is inside your broadband server (ie your router)??? well, that would be the same as a phone tap. Those are either wireless (transmit through air waves) or they phone home... You still wouldn't be able to see it, because it would be in promiscus mode. If it is a tap, and it has a 10. number, then it would still have to phone home, because no one could access it remotely, because they can't access a 10. number (ok, yeah there's firewalking, get over it) Anyway, it still doesn't seem right.

Now if you are saying that it is in the server that you connect to, then its still the same thing. Thats like a tap on the dmark. You actually dialup to that machine...(in a sence). Sounds more like it is a router sitting there for everyone that uses a cable modem in your area...

Can you give some links or something on where you did your "homework"?

Are you absolutely sure that this mysterious box isn't your cable modem? Quite a few cable modems have their own IP address, and a lot of cable companies use the private address space for thier internal routers and cable modems to simplify matters. They just set up a DHCP server, the cable modem asks for an IP address and they assign it an IP from the 10 subnet so they don't have to waste a valid IP address on a simple cable modem. Then as long as their internal routers know where to route the packets, they're ok. So maybe your cable company just changed their internal network architecture. Give it a thought.

Ummmm... guys?!?!?

Many ISPs use private addressing for their serial lines between the routers in their core infrastructure so that they can save the IPs they have FOR YOUR USE. There's no reason that anyone outside of their infrastructure ever needs to talk to one of their routers directly, so it's much more secure and signs of a much better and well-planned infrastructure if your ISP actually uses these.

It is not necessarily a sign of a wire tap

Most taps, on the other hand, are passive. That is, they sit on a segment with the transmit leads clipped and looped back so that there is no way in hell that you can see them from the monitored side of the connection.

Quote:

---

Most taps, on the other hand, are passive. That is, they sit on a segment with the transmit leads clipped and looped back so that there is no way in hell that you can see them from the monitored side of the connection.

---

While it used to be possible to clip wires and still listen to traffic, with the advent of ethernet it is no longer possible. This is due to a feature in networking known as a heartbeat (not the technical term). If you clip the transmit wires between a computer that you're trying to listen with and a hub, the hub no longer hears the heartbeat from the ethernet card and assumes that the machine is off. So the link is lost, the link light turns off and the hub no longer transmits data down that wire. Trust me, I've tried. The only way to do this is to either set up a passive interface on the computer (i.e. no IP address) or buy a device known as a network tap that generates the heartbeat for you and allows your computer to still listen in on the traffic passing through the hub.

Quote:

---

Originally posted here by str34m3r

While it used to be possible to clip wires and still listen to traffic, with the advent of ethernet it is no longer possible. This is due to a feature in networking known as a heartbeat (not the technical term). If you clip the transmit wires between a computer that you're trying to listen with and a hub, the hub no longer hears the heartbeat from the ethernet card and assumes that the machine is off.

---

Hence the need for a loopback, as I indicated (albeit rather tersely).

Have you tried this and found it to work? If so, I need to know what kind of hub/switch you're using and buy some. Becuase I worked on this exact problem for two days and never found any solution except the ethernet taps. I tried several different configurations of wires (including looping back some of the wires) and several different hubs and switches. The best I ever got was one hub that let me sniff for about 15 seconds before the loopback was too much for it and it locked up totally. Now I've never seen a hub lock up before, but I guess it got very confused and just started blocking all traffic. I'm certain that if there was a way to connect a monitor to the hub, there would have been a blue screen of death. :)

The loopback is done in such a way as to provide voltage, but not much more... I'll see if I can grab the pinout for you, if you like. (But yes, I've used it - it's my preferred method for running network IDS boxes as it tends to help prevent people from "seeing" them and trying to get around them).

The second means of course, as I think has already been said, is to mirror a port on a switch and listen that way... ISS supports putting interfaces in "stealth mode," but personally I don't trust it (ISS also tends to be one of the last choices for me for IDS boxes, etc). Mirroring can also be kind of "expensive" on a busy switch and can lead to serious problems/issues, so I'd personally not recommend it.

I thank everyone for their input and inquiries. I use VisualRoute Trace all the time; I know what is normal between me and my ISP's servers. As I said it normally reads xxx.xxx.xxx.xxx as my computer and then immediately following that is the ISP's server at yyy.yyy.yyy.yyy and over the weekend between the two systems apeared 10.228.200.1 which does not respond to ftp/http/telnet or id requests.

It is not my cable modem, or I would have seen it for the past year or so. It is not used by my broadband ISP, and it is BEFORE their servers not in/after... ok, so it COULD be IN the server, but then why would it show seperately?

I agree, taps are NORMALLY passive. This one is... unless you trace routes like I do on a regular basis and know when something is not right in the trace.

An internal change of routing by the ISP... sounds possible, but you would think THEY would know. What gets me is others can hit the IP this thing sets at, and it comes up right where I see it, but my provider "does not see anything at that address between us and your computer, but we also don't see your computer. Are you running a firewall?". Not the brightest bulbs in the package, but they should be able to see the 10 IP like my friends do when they trace to me.

str34m3r, love your phrase "Paranoia is the only sane approach. In this business, you would be crazy not to be paranoid." but don't forget... Just because you are paranoid does not mean they are not out to get you. :)

It might be interesting to see how many hops (TTL diffs) the guys at your ISP get if they ping you. If the "conspiracy theory" is true, I would bet the eavesdropper is filtering connections from the ISP "managment" (techs and admins computers) so his box doesn't show up to them.
However I doubt he would have hacked the kernel to not decrease the TTL values from ip packets. Thus inspecting TTLs from packets comming from the ISP could reveal the attacker's presence to the ISP techs.

I gotta say though that the eavesdropper theory sounds unprobable to me, but if you say that your ISP knows noting of such an host on their network I'd probably get suspicious too...

Ammo

Also, you might want to try some nmap scans* on the rogue host to gather more information...

*Check your ISP's AUP first!

Ammo

Quote:

---

Originally posted here by Airwolf
I thank everyone for their input and inquiries. I use VisualRoute Trace all the time; I know what is normal between me and my ISP's servers. As I said it normally reads xxx.xxx.xxx.xxx as my computer and then immediately following that is the ISP's server at yyy.yyy.yyy.yyy and over the weekend between the two systems apeared 10.228.200.1 which does not respond to ftp/http/telnet or id requests.

---

Of course, no one ever changes the structure of their networks, let alone the addresses. Particularly during weekend maintenance hours.

And, as you said, 10.0.0.0/8, 172.16.0.0/12 and 192.168.0.0/24 are "reserved network address space." Specifically, these are addressed/outlined in RFC1918 and are used "for networks not connected to the Internet." What this /really/ means is that they're not meant for anything that connects directly - when was the last time you got on a router's serial port to browse the web or anything? And again, most ISPs block these addresses as a matter of principle at the very point in which they become moot. So, you pinging the thing is going to go one hop beyond your router/modem and STOP (ie. bit-bucket); try tracerouting to them... chances are it's not going to go anywhere.

Just because something doesn't respond doesn't mean it's "a tap." And, just because you can't ping something doesn't mean the server's down. I know it's a tough concept, but trust me here. Try pinging www.antionline.com, too, and set off some of JP's alarms for him... chances are you're going to get back ICMP DEST Unreachables (which are completely optionable - most BofHs just trash annoying things like that rather than creating additional network traffic with a reply of any sort). <edit>So, tell me... you can't ping or "id" www.antionline.com but, well, how are you reading this message then?</edit>

Quote:

---

It is not my cable modem, or I would have seen it for the past year or so. It is not used by my broadband ISP, and it is BEFORE their servers not in/after... ok, so it COULD be IN the server, but then why would it show seperately?

---

You were right the first time... they're part of the trace/path. What you are seeing is the source of the packet in the ICMP ECHO-REPLY header. For all intents and purposes, it's meaningless (and intentionally makes it more difficult for you to figure out the path your packet is taking through their systems).

Quote:

---

I agree, taps are NORMALLY passive. This one is... unless you trace routes like I do on a regular basis and know when something is not right in the trace.

---

With the advent of dynamic routing, packets sent side-by-side don't always take the same path, particularly through large networks. That is, two consecutive pieces of a transmission, in theory, can possibly be transmitted through completely separate parts of a network.

Quote:

---

An internal change of routing by the ISP... sounds possible, but you would think THEY would know. What gets me is others can hit the IP this thing sets at, and it comes up right where I see it, but my provider "does not see anything at that address between us and your computer, but we also don't see your computer. Are you running a firewall?". Not the brightest bulbs in the package, but they should be able to see the 10 IP like my friends do when they trace to me.

---

Most helpdesk people are simply following procedures, and not well at that... invariably, anyone you can talk to doesn't know squat about tcp/ip, except it's this "network thingy." Having worked for a global ISP before, I can tell you that the trend is that anyone that shows promise on being able to troubleshoot things like network issues tends to find themselves not on the phone talking to people but in baseline NOC or higher up (possibly a junior engineer), helping to troubleshoot and fix the problems that the clueballs down on the phone are coached enough to filter on when it gets deeper than their "bullsh*t level." (ie. they talk to people so the people who actually know something can do something worthwhile)

One of my favorite quotes taken from a call to tech support that I made: "Well, traceroute to it and you'll see that it's a line problem." Of course, he didn't understand me telling him that my firewall dropped all spurious UDP.

Quote:

---

Originally posted here by ammo
It might be interesting to see how many hops (TTL diffs) the guys at your ISP get if they ping you. If the "conspiracy theory" is true, I would bet the eavesdropper is filtering connections from the ISP "managment" (techs and admins computers) so his box doesn't show up to them.
However I doubt he would have hacked the kernel to not decrease the TTL values from ip packets. Thus inspecting TTLs from packets comming from the ISP could reveal the attacker's presence to the ISP techs.

---

Unfortunately (?), it is extremely common for traceroutes to differ greatly in opposite directions. This is due both to:

• routes between different IPs (the source and destination) tend to be different and thusly assymetric
• at best (ie. symettric routes) you tend to be looking at two different sides of a dual-homed router and the reply you get will be based on the source that you would see (can someone help me phrase that better?)

In short, assume you have a very simple network (apologies if I blow this, I'm typing this "blind," etc, in hopes of trying to explain what's going on here):

Code:

---

      Server - 192.168.3.2
              |
Router A (e0) - 192.168.3.1
Router A (s0) - 192.168.2.254
              |
      [serial line]
              |
Router B (s0) - 192.168.2.1
Router B (e0) - 192.168.1.1
              |
      My Host - 192.168.1.2

---

Now here, you have four systems... we want to go from the bottom to the top (our host to the server). <edit>Our networks, for clarification, are:

<edit>
LOCAL LAN: 192.168.1.0/24 (that's 192.168.1.0 - 192.168.1.255)
SERIAL LINK (t1): 192.168.2.0/24 (that's 192.168.2.0 - 192.168.2.255)
REMOTE LAN: 192.168.3.0/24 (that's 192.168.3.0 - 192.168.3.255)
</edit>

If we traceroute from our host, assuming UDP/ICMP are completely open, we should get responses from:

192.168.1.2
192.168.1.1
192.168.2.254
192.168.3.2

But if we get on the server, we'll get responses from:

192.168.3.2
192.168.3.1
192.168.2.1
192.168.1.2

...but yet the routes are said to be symettric because they follow the same path out and back.


Now, if we extend that one step further, your local network is xxx.xxx.xxx.0/24, the serial line (the "taps" as we say) could be 10.0.0.0/24 (10.0.0.0 - 10.0.0.255) and the hop on the other side of it yyy.yyy.yyy.yyy. Make a little more sense?

Quote:

---

I gotta say though that the eavesdropper theory sounds unprobable to me, but if you say that your ISP knows noting of such an host on their network I'd probably get suspicious too...

---

Helpdesk people can usually not even tell you what type of router a particular system is, let alone that it even exists.

I wouldn't doubt there's a "tap" there somewhere... most semi-curious ISPs will likely run some sort of NIDS system, though possibly a bit primitive (the more advanced ones tend to not be that easy to setup, let alone maintain as compromises and attacks are formulated). But they do normally do dumb/primitive things... like trying to make sure that people from unauthorized hosts aren't trying to probe or login to their routers.

>> Mirroring can also be kind of "expensive" on a busy switch and can lead to serious >>problems/issues, so I'd personally not recommend it.


I wouldn't recommend trying to mirror every port on a very busy switch, but I have seen multiple ports mirrored to multiple other ports (on connections between internet routes/internet firewalls) with zero side effects on a cisco 3500 series switch. The key is to make sure you are not having mirror 1000 ports to one port, then you could have major problems, but if you chose to do it at choke points (entry ways into a network), you can get away with mirroring one port and the load difference isn't all that noticeable (I have seen this work at speeds up to 60Mb/s (realistic speed of a 100Mb cat 5 ethernet) with no problem and it may work at higher speeds, I just haven't been privelaged enough to play with gig-e all that often yet)...

Just a thought...

aah.. your right draziw, I guess I let myself get caught in the conspiracy thing ;) (Guilty of PWS: posting while sleepy...)

Great explications though!

Ammo

I have optimum online, and i also get that 10.x.x.x IP address as my first ip address after my router. I do not know what it is, but i am starting to get annoyed because it is always doing port scans on me >:(

Don't worry about that kind of tap, the government can use a normal phone tab, then record the sounds on the line (those nasty modem screaches) and put it through a program that can partially piece together what is going on.